On Friday, June 12, the US government imposed export controls on Anthropic's newest models, Claude Fable 5 and Claude Mythos 5. This required Anthropic to restrict access to foreign nationals both inside and outside the United States. Because the order was effective immediately and Anthropic had no reliable method to verify nationality in real time, access to both models was suspended for all users.
As of June 30, the export controls on Fable 5 and Mythos 5 have been lifted.
Fable 5 will become available starting Wednesday, July 1, to users globally on the Claude Platform, Claude.ai, Claude Code, and Claude Cowork. For Pro, Max, Team, and select Enterprise plans,^1 Fable 5 will be included for up to 50% of weekly usage limits through July 7, after which it will be accessible via usage credits. Access on AWS, Google Cloud, and Microsoft Foundry will be re-enabled as quickly as possible.
Anthropic has also restored access to Mythos 5 for a set of US organizations, following the US government's approval on June 26. The company continues to coordinate with the government to expand access to the broader set of domestic and international partners in the Glasswing program.
The remainder of this post provides further details and updates in four areas:
- A timeline of events, including updates made to Anthropic's safeguards. This section discusses the events that led to the export control directive and how Anthropic addressed them with new safeguards.
- Anthropic's general approach to safeguards. More context is provided on how Anthropic uses safety classifiers to detect potentially dangerous cybersecurity uses of its models.
- A shared industry framework. Although a constructive resolution was reached, these events highlighted the industry's need for a consistent way to assess and fix potential "jailbreaks" of AI models (techniques that bypass a model's safeguards).^2 A shared standard for judging jailbreak severity would help AI developers triage new findings, launch highly capable models with greater safety, and communicate risk levels consistently to government and industry partners. Together with Amazon, Microsoft, Google, and other Glasswing partners, Anthropic has begun developing such a framework, outlined below.
- Deeper government collaboration. Anthropic is also strengthening its collaboration with the US government on new pre-release testing, information sharing, and research collaboration, described in the final section.
Timeline and Safeguard Updates
Anthropic released Fable 5 and Mythos 5 on Tuesday, June 9. Both share the same underlying model, but Fable 5 was released with strong safeguards for safe general use. Mythos 5, which has fewer safeguards, was only released to a small number of trusted Project Glasswing partners for defensive cybersecurity purposes.
The export control directive on June 12 came after the government became aware of a report in which Amazon researchers had found a method of bypassing Fable 5's safeguards: prompting it so that it identified a number of software vulnerabilities. In one case, the model produced code demonstrating how the relevant vulnerability could be exploited. Over the following two weeks, Anthropic worked closely with the government and other partners, including Amazon, to review the report and evidence.
Anthropic's testing confirmed that many less capable models-including Claude Opus 4.8, GPT-5.5, and Kimi K2.7-could identify the same vulnerabilities as Fable 5 did in the report. When it came to the demonstration of how to exploit the single vulnerability, every model tested could produce the same demonstration as Fable 5 (including Claude Haiku 4.5, Sonnet 4.6, Opus 4.6, Opus 4.7, Opus 4.8, GPT-5.4, GPT-5.5, and Kimi K2.7).
Importantly, the reported technique did not expose any unique Mythos-level cyber capabilities. The behavior reflected a borderline case for Fable 5's safeguards-as explained below, some tasks that are unlikely to be dangerous are nonetheless blocked out of an abundance of caution. The reported technique allowed access to one such behavior, but it only involved routine defensive cybersecurity work.
Even so, Anthropic moved quickly to address the reported bypass. Working closely with the government, the company trained an improved safety classifier that targets and blocks the behavior described in the report. Users will be notified if a request to Fable 5 is blocked, and the request will instead be sent to Opus 4.8.
The new classifier means the specific technique described in the Amazon report is blocked in over 99% of cases. In a very small fraction of cases, the model may provide information that isn't detailed enough to help a cyberattacker. As described below, the model's safeguards are not expected to block all low-risk routine cyberdefense capabilities-just those that are potentially harmful. Researchers from the US Department of Commerce's Center for AI Standards and Innovation (CAISI) have tested both the prior and new safeguards and agree that they are extraordinarily strong.
The new classifier also comes at the cost of flagging benign requests more often during routine coding and debugging tasks. As with all of Anthropic's safeguards, the company will continue to refine this to better distinguish genuine misuse from legitimate requests and reduce false positives.
Anthropic's Approach to Cybersecurity Safeguards
Claude Mythos 5 can be used to find and exploit software vulnerabilities more effectively than any other model-and all but the most skilled human security experts. These prodigious cybersecurity capabilities make it uniquely attractive to malicious actors who wish to misuse it in cyberattacks.
Claude Fable 5, however, provides no such unique offensive capabilities.
Fable 5 launched with a variety of safety mechanisms, each of which alone does not provide perfect defense but when combined make the model very difficult to misuse (an approach known as "defense in depth"). Some defenses involve training the model to decline to assist with dangerous requests; others involve retroactively analyzing patterns of misuse.
One particularly important safety mechanism involves classifiers-smaller automated AI systems that, during an interaction, detect when the model is asked to perform a potentially harmful cybersecurity task (or produces potentially harmful outputs). When this occurs, the classifiers block the model from responding to requests. The ultimate goal of these classifiers is to prevent the model from engaging in uniquely dangerous behaviors.
Like all safety mechanisms, classifiers can make mistakes. They sometimes fail to notice potentially dangerous content, and in some cases they can be deliberately "jailbroken": users can prompt the model in unusual ways to trick the classifiers and get the model to produce harmful outputs that the system should have blocked.
Anthropic therefore deliberately sets the safety classifiers to trigger on a set of requests that are known to be likely benign. This "safety margin" approach means that a request has to look very clearly safe to avoid triggering the classifier (see row A in the diagram below). Users experience the safety margin as a model refusing to respond to some reasonable, non-harmful requests.
For Fable 5, Anthropic made this safety margin much larger than in any prior launch (row B), meaning that many more benign requests would be blocked. The company understood that these kinds of false positives would be frustrating for users but made this tradeoff in the interest of making the model's other capabilities widely available.
An illustration of Anthropic's cybersecurity safety classifiers. When a request is made to the model, the classifiers detect whether it is benign (and allowed) or potentially harmful (and blocked). The classifiers block ambiguous requests (those that are clearly related to cybersecurity but could potentially be for defensive purposes, like finding security vulnerabilities) and harmful requests (those that are clearly dangerous, such as a request to build a chain of software exploits). As shown in row A, a "safety margin" is also included, where the classifier will block requests that are probably benign but have some small chance of being harmful. This increases confidence that all harmful requests will be blocked. For Fable 5 (row B), the safety margin was made even larger, meaning that more benign requests would be blocked-but fewer genuinely harmful requests would be missed.
The safety margin also helps mitigate jailbreaks. Many jailbreaks are narrow: they unblock a very specific model behavior but nothing more. In some cases, a hypothetical user can jailbreak the model in a minor way and intrude into the safety margin (or sometimes into ambiguously harmful behavior), but not to the core harmful behaviors that are meant to be blocked (row C below). Anthropic's view is that jailbreaks of Fable 5 reported so far fit into this minor category.
More serious jailbreaks unblock more harmful behaviors. Narrow harmful jailbreaks (row D) can elicit some specific harmful behaviors. These jailbreaks are typically of low to moderate severity because the narrowness limits the attacker. The most concerning category is a universal jailbreak (row E), which unblocks a wide range of harmful behaviors.
How jailbreaks interact with Anthropic's safety classifiers. In the case of a minor jailbreak (row C), the classifiers do not block the request, but the request is still within the safety margin (and is thus very unlikely to be harmful). In a narrow harmful jailbreak (row D), the prompt breaches the classifiers and unblocks a specific harmful behavior from the model. In a universal jailbreak (row E), a prompt unblocks an entire class of harmful behaviors.
As Anthropic noted when it launched Fable 5, it is probably impossible to make any AI model fully robust (that is, impervious) to jailbreaks.^3 Some jailbreaks are expected to be found, and they will vary in severity: many minor jailbreaks, some narrow harmful ones, and although no universal jailbreaks for Fable 5 have been discovered at the time of writing, expert safety researchers continue to red-team it. Anthropic seeks to ensure that it and its safety partners will be the first to find major jailbreaks and fix them before malicious actors can use them for harm.
The cautious approach outlined above means that the vast majority of jailbreaks will not successfully unblock dangerous behaviors. Anthropic's classifiers make successful jailbreaks very costly and high-effort to produce, and even if a jailbreak is successful, extra layers of defense provide additional mitigation. Anthropic will continue to update its classifiers as it learns more about novel jailbreak techniques.
A Consensus Industry Framework for Jailbreaks
There is currently no consensus in the AI industry on how to describe, in objective terms, the severity of an AI jailbreak. This adds a great deal of uncertainty whenever a new jailbreak technique is discovered: developers have no agreed-upon standard for which findings to focus on most urgently, and governments have no agreed-upon standard for when to act.^4
This problem will become more acute in the coming months, as more models with powerful cybersecurity (and other) capabilities are trained, assessed, and released. A common standard for assessing AI jailbreaks would help Anthropic and other companies launch new models safely, as well as allow users to make the most of their advanced capabilities.
Anthropic is therefore partnering with Amazon, Microsoft, Google, and other Glasswing partners to draft a consensus framework for assessing the severity of AI jailbreaks and how AI developers should respond to them. Other industry partners and model providers are invited to join this effort.
Anthropic's current proposal is to score a given jailbreak on four different criteria. The first two describe what the jailbreak provides to the attacker; the latter two describe how quickly the jailbreak can become a real-world problem:
- Capability gain. How far beyond existing tools does the jailbreak take the user? If existing widely available tools (including other, weaker AI models) can reach the same capability as the jailbroken model, the score will be low; if the jailbreak unblocks model capabilities that can significantly accelerate even domain experts, the score will be high.
- Breadth of capability gain. For how many distinct offensive tasks does the same jailbreak technique work? Cases where the jailbreak only allows the model to pursue narrow targets will score low; cases where the same jailbreak technique works for multiple different targets or techniques will score high.
- Ease of weaponization. How much human effort does it take to turn the jailbreak into an attack? Where the jailbreak involves a great deal of skilled prompting and many retries, the score will be low; where the jailbreak works on a single prompt or on the first or second try, the score will be high.
- Discoverability. How easy is it for someone to obtain the technique? If it requires specialist knowledge it will score low; if it is already widely known and available online it will score high.
Anthropic proposes to use this severity framework to calibrate the response to newly discovered jailbreaks. For the most severe class of jailbreaks (e.g., a jailbreak that, among other characteristics, is being used to actively cause a devastating impact on critical power grids or banking systems), preliminary mitigations will be immediately deployed upon confirmation of severity. Anthropic is also creating a team to provide 24/7 monitoring of key jailbreak submission channels.
Any method of scoring jailbreaks will be imperfect. Still, there is value in being able to communicate the approximate severity of a given finding through a common framework. This is a work in progress; as feedback is received from more partners, the framework is expected to evolve over time.
More details on the proposed framework are expected to be shared soon. In the meantime, Anthropic is also launching a new HackerOne program where security researchers can submit potential cyber jailbreaks they've discovered in Fable 5 (once available) for review.
Partnering with the US Government on Frontier AI Security
Over the past ten weeks, Anthropic has worked closely with the US government as it developed the approach reflected in the June 2 Executive Order on Promoting Advanced Artificial Intelligence Innovation and Security. Anthropic's engagement spanned the Office of the National Cyber Director, the Office of Science and Technology Policy, the Department of the Treasury, the Department of Commerce (including CAISI), and relevant national security agencies.
Anthropic is committed to continuing that work, building on nearly two years of pre-existing collaborations with US government partners on pre-deployment testing and evaluation. The commitments below reflect both that pre-existing work and Anthropic's new proposals to scale up government collaboration as the above framework is finalized:
- Pre-release government access and evaluation. For models that materially advance the capability frontier in areas relevant to national security, Anthropic will provide designated government partners with expanded early access to both the models and the safeguards that accompany them. Those partners can then run independent capability evaluations and test guardrails before broad release. Anthropic will dedicate technical staff to work alongside government evaluators during these testing periods.
- Rapid information sharing on safeguards. When significant jailbreaks or misuse patterns are identified, Anthropic will quickly investigate, triage, and notify appropriate government counterparts. The company will share the new safeguards it builds in response so they can be independently tested. Anthropic will also provide government partners with threat intelligence reporting in advance of publication and participate in the interagency cybersecurity vulnerability clearinghouse established under Sec. 2(d) of the June 2 Executive Order.
- Dedicated resources for joint research. Anthropic is substantially scaling up joint work with government partners on AI security. The company will stand up dedicated teams to work on shared government priorities, provide a significant compute allocation to support government testing and research, and make its safety and red-teaming expertise available to help advance the state of the art in AI evaluation.
- A common industry bar. Anthropic will work with the government and with industry peers toward a shared, voluntary security and evaluation standard for frontier model providers. The company will contribute evaluations, tooling, and best practices that the government can apply across the field.
Anthropic's hope is that this collaboration, along with the proposed consensus industry framework, will serve as the basis for systematic rules for the whole industry-and even offer the beginnings of a template for effective global coordination on the risks and benefits of AI.
These rules should be codified in strong regulation and applied equally across frontier model developers. Government involvement in AI releases requires a durable, transparent process that gives cyber defenders and others the certainty they need about access to powerful models.
Anthropic looks forward to deepening its government collaboration in the ways described above. The company is also grateful to its users for bearing with it through this disruption, and to the researchers and industry partners who worked alongside Anthropic to make Fable 5 and Mythos 5 available again.
Footnotes
- For standard Enterprise seats, there is no included Fable 5 allowance. All Fable 5 usage is billed through usage credits. If credits are not enabled, Fable 5 will not work for users. For premium Enterprise seats, through July 7, Fable 5 is included in the subscription. It draws from each member's seat usage at no additional cost. After July 7, teams can continue using Fable 5 by enabling usage credits. If credits are not enabled, Fable 5 will no longer work for users.
- Note that sometimes the term "bypass" is itself used instead of "jailbreak." For current purposes, these are considered synonyms, but "jailbreak" is used throughout because (a) it is a more commonly used term and (b) it is consistent with the terminology used in Anthropic's previous work.
- Analogously, no piece of software is immune to vulnerabilities (though in general, software vulnerabilities are more straightforwardly discovered and patched than LLM jailbreaks).
- In other areas of security research, there are agreed-upon standards: for example, the Common Vulnerability Scoring System (CVSS) is a common way of assessing the severity of a given software vulnerability.